Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A researcher publishing under the handle grizzzer has published a detailed account of how a critical event was completed on the Standoff 365 online polygon: defacing the digital banking web service of First Partner Bank.
The target application ran at dbo.fpb.stf. Initial reconnaissance used a DNS zone transfer from the authoritative server at 10.124.1.34, which disclosed four hosts including the banking service itself.
After adding the discovered hosts to /etc/hosts, the researcher opened the login page and used Wappalyzer to identify the technology stack: React, Express, and Node.js. An interesting server-rendered endpoint was found at /docs-server/receipt that accepted an email parameter and returned HTML generated by a server-side template engine.
Fuzzing additional parameter names with Burp Suite Intruder revealed that the undocumented pretty parameter was interpreted by the Pug template engine because the application passed the entire req.query object into pug.renderFile via the spread operator. This classic SSTI condition allowed an attacker-controlled value to be injected into the generated JavaScript output.
A carefully crafted payload closed the existing string context and used process.mainModule.require to import the net and repl modules, establishing a reverse shell that provided an interactive Node.js REPL. From this shell the researcher located the file /app/public/locales/en/translation.json, which contained interface strings loaded by the React frontend.
Using a single writeFileSync command, the value of the info.welcome-to key was replaced with the string pwned by VON. Because the React application fetches the JSON file on every page load, the modified text immediately appeared on the authorization page for all users without requiring a server restart.
The complete attack path was: DNS AXFR reconnaissance, parameter fuzzing, exploitation of Pug SSTI, Node.js RCE, and modification of the localization file. The researcher emphasized that the root cause was unsafe handling of user input inside the template engine and provided several concrete mitigation steps, including restricting DNS zone transfers, updating Pug to version 3.0.3 or later, and avoiding direct forwarding of query parameters into template options.
Related articles
Attackers Exploit Critical Atlassian Data Center Flaw CVE-2026-21589 Hours After PoC Release
Exploitation attempts against CVE-2026-21589 began almost immediately after technical details and a Nuclei template were published. The vulnerability allows unauthenticated arbitrary file read in multiple Atlassian Data Center products and carries a CVSS v4.0 score of 9.3. In environments integrated with Crowd, attackers who obtain crowd.properties can extract plaintext credentials and escalate to administrator privileges via the Crowd API. The flaw stems from improper handling of double-colon sequences in a shared web resource library, enabling path traversal against plugin resource endpoints. Affected products include Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian urges immediate patching outside normal cycles and recommends WAF rules or Tomcat RewriteValve configurations to block traversal patterns. Organizations should also review access logs for double-decoded URLs containing .., /, \, or :: sequences.
LibreOffice and Apache OpenOffice Flaw Enables Remote Code Execution via Malicious Calc Tables Without Macro Warnings
Researchers have demonstrated an attack against LibreOffice and Apache OpenOffice users that executes arbitrary Java code simply by opening a malicious spreadsheet, without requiring macro permissions or triggering any security prompts. The vulnerability requires Java support to be enabled in the office suite and exploits legitimate features in the Calc component that automatically fetch data from external database sources. When a crafted document is opened, Calc loads a linked database file that references a malicious Java driver, allowing the attacker’s code to run inside the office process. LibreOffice has already patched the issue tracked as CVE-2026-63277 with the release of versions 26.2.5 and 26.8.0 on October 5, while Apache OpenOffice remains vulnerable up to version 4.1.16 under CVE-2026-59265 with a fix expected in 4.1.17. The attack chain works on both Windows and Linux and bypasses macro protections entirely because no user consent dialog appears. Although only a proof-of-concept exploit that launches the calculator has been published so far, the same technique can execute any Java payload. Users of OpenOffice are advised to disable Java or avoid untrusted files until the patch is available.
Atlassian Fixes Critical Path Traversal Flaw CVE-2026-21589 Exposing Files in Jira and Confluence
Atlassian has patched CVE-2026-21589, a CVSS 9.3 path traversal vulnerability that allows unauthenticated attackers to read files across eight products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye in Data Center editions. The flaw accepts manipulated paths where traversal sequences appear adjacent to forward slashes, backslashes or double colons, including URL-encoded variants. Attackers must know the exact file name and path because the vulnerability does not permit directory listing and is restricted to the web application root directory of each product. Configuration files located in predictable locations remain accessible to attackers familiar with the products. Patches have been released in specific versions such as Bitbucket 10.5.1, Confluence 10.2.19, Jira Software and Jira Service Management 11.3.12, Bamboo 12.1.12, Crowd 7.2.4 and Crucible and Fisheye 4.9.15. Atlassian found no evidence of exploitation in its cloud products, though the advisory does not address on-premises customer installations.
Apache Struts CVE-2026-104711 Enables Remote Code Execution via Legacy RESTful Mapper
Apache Struts has patched four vulnerabilities, one of which permits unauthenticated remote code execution through an OGNL injection flaw. The issue, tracked as CVE-2026-104711, only affects applications that still rely on the legacy RESTful mapper; modern configurations using the default mapper, restful2, or the official Struts REST plugin remain unaffected. Exploitation occurs when the legacy mapper extracts action names and parameters directly from the URL, allowing attackers to inject malicious OGNL expressions. Vulnerable releases span 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0, with fixes available in 6.12.0 and 7.4.0. The remaining three flaws impact availability or cause cross-request data leakage but do not lead to code execution, and only one received an “important” severity rating.